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BSPR: 

Thus, it can be seen that there is a need to define a 
way in which access to 

devices can be transparently recovered, that is, 
rebuilding the internal system 

software framework to allow some other node in the 
cluster to assume the role 

of the controlling entity for the device in such a way 
that users and 

applications are not aware that a failure occurred. 
This has many 

implications. For instance, the device's state must be 
preserved so it looks 

exactly the same as it did, before the failure. The 
device driver on the new 

controlling node must have the same state information 
and be able to process 

requests in the same manner as the device driver on the 
failed node. The way 

in which the user accesses the device must remain 
exactly the same although the 

user's requests now have to go to a different node in 
the cluster. Any 

requests in transit or on the device at the time of the 
failure must be 

analyzed and replayed if necessary. All this and more 
needs to take place 

transparently. The combination of the SAN-based system 
architecture and an SSI 

distributed operating system provides the basic 
framework on which a solution 

for high availability access to I/O devices can be 
built . 
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DEPR: 

States 51 to 59 perform the reverse operation and are used to restore values 
of 

variables which have been modified in the recovery block of an 

acceptance test. States 51 r-rgservea the value of the current recovery level 

register E in the internal register CO. States 54 to 57 form a loop which 
scans the top region of the cache store. For each word in the top region of 
the cache store, states 56 and 57 read the main store address of a variable, 
its prior value and its prior recovery level into registers A, H and E 
respectively and write the prior value and recovery level into the main store 

and level store respectively. State 58 adjusts the pointer to the top of the 

cache stack (stored in register CP). State 59 restores the value of the 
current recovery level into the register E. 
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TITLE: Processor and method for delaying the processing of cache coherency 
transactions during outstanding cache fills 

DEPR: 

The backup cache 15 for the CPU 10 is a "write-back" cache, so there are 
times 

when the backup cache 15 contains the only valid copy of a certain block of 
data, in the entire multi-processor system of FIG. 1. The backup cache 15 
{both tag store and data store) is protected by ECC. Check bits are stored 
when data is written to the cache 15 data RAM or written to the tag RAM, then 

these bits are checked against the data when the cache 15 is read, using ECC 
check circuits 330 and 331 of FIG. 4. When an error is detected by these ECC 

check circuits, an Error Transition Mode is entered by the C-box controller 
306; the backup cache 15 can't be merely invalidated, since other system 
nodes 

28 may need data owned by the backup cache 15. In this error transition 



■;he <i:it« is pr(?3t?.rveci in the backup cache 15 as much as possible for 
di^jicrstiTcs"] but operation continues; the object is to move the data for 
which 

this backup cache 15 has the only copy in the system, back out to system 
memory 

12, as quickly as possible, but yet without unnecessarily degrading 
performance. For blocks (hexawords) not owned by the backup cache 15, 
references from the memory management unit 25 received by the cache 
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TITLE: Redundant automation controller with deductive power -up 



BSPR: X. V. 

Thus, it is one object of the invention to provide a mechanism that better 
selects which controller should become a primary controller a^ften a power 
loss. 

The 3tate -r^erio^ies^Dreaerved iifter the power loss are reviewed by the 
contr"oflersrTo uniqiieTy "TdenH'fy ' o^^ controller to be the primary controller. 

Generally, the data inclxjides indications as to what controller was the 
primary . . , 

controller immediately before power-down, indications of the H\MH£5^ °^ 
modules 

in one or the other controller, indications of lack of programming m one of 
the controllers, and time of power-down. 
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